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Background Information 



The present invention is directed to a protective device for a 
vehicle according to the definition of the species in the 
independent claim. 



A safety device for motor vehicles is known from 
Of f enlegungsschrif t DE 199 60 179 Al . The motor vehicle has 
one airbag or multiple airbags in this case which can be 
deactivated via switching means. The switching means are 
designed here in the form of a deactivation switch. 

Advantages of the Invention 

The protective device for a vehicle according to the present 
invention having the features of the independent claim has the 
advantage over the related art in that, in addition to 
analyzing the switch position using a processor, another 
module for analyzing the switch position is present which 
functions independently from the processor. A hardware 
redundancy is thereby established. For its function, this 
module advantageously has at least one logic module. It is 
possible to provide delay times and hold times of any length 
for the module's logic state time-variant approaches by using 
such logic modules. Tolerances are now irrelevant due to the 
use of logic modules. Long delay times and hold times of a few 
hundred milliseconds are easily implementable due to the use 
of logic modules. 

The measures and refinements cited in the dependent claims 
make advantageous improvements on the protective device for a 
vehicle cited in the independent claim possible. 
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It is particularly advantageous that the at least one logic 
module is designed as a gate and/or as a flip-flop. In order 
to make the particular length of the delay times and hold 
times of the module's logic state possible, a combination of 
5 different gates and flip-flops may be provided. A freeze- in of 
the logic result in particular is thus possible. 

Furthermore, it is advantageous that the at least one logic 
module is configured in such a way that a time response of the 
10 logic module's logic state is variable. This may be carried 

out in particular via the processor, which, however, exerts no 
influence on the module's analysis of the signal from the 
switch. The time response refers to the delay times and the 
hold times of the logic state. 

15 

Furthermore, it is advantageous that the switch is designed 
either as a resistor network or as at least one Hall sensor. 
These are two reliable circuit concepts for a switch. 

20 In addition, it is advantageous that the power supply of the: 

switch is provided either from the control unit, e.g., for the 
* restraint systems, i.e., the protective device, or that an 
external power supply of the switch is made available which 
makes a direct connection to the vehicle battery possible. 

25 

Finally, it is also advantageous that an AND gate is provided, 
gating together a signal of the module and a signal of the 
processor, so that only in the case of a logic 1 of both 
inputs is a new output signal of the module relayed. 

30 

Drawing 

Exemplary embodiments of the present invention are illustrated 
in the drawing and are explained in greater detail in the 
35 description below. 

Figure 1 shows a first block diagram of the protective device 
according to the present invention, and 
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4) 

Figure 2 shows a second block diagram of the protective 
device according to the present invention. 

Description 

5 

In today's vehicles the possibility is provided for 
deactivating the passenger-side airbag or the rear side 
airbags using a switch, i.e., an airbag deactivation switch. 
For this purpose, the position of a key switch, for example, 

10 is analyzed by the airbag control unit. Different concepts are 
possible for implementing the switch. Switches, having 
resistor networks where the switch switches between two 
different resistor dividers, and switches made up of one or 
two Hall sensors are commonly used. These are switched without 

15 contact, which results in high mechanical robustness. 

Since the airbag deactivation function is safety-critical., the 
analysis in the airbag control- unit is normally designed to be 
redundant. Analysis of the switch position and activation or 

20 deactivation of the airbag (s) are normally carried out via 

software and via a hardware path which is independent from the 
microcontroller. Depending on the switch position, this 
hardware path or module additionally activates or deactivates 
the respective restraining means -- triggering circuits for 

25 airbags, seatbelt tensioning devices, or other restraining 
means such as, for example, an electromagnetic valve for a 
roll bar -- via the hardware, thereby ensuring that erroneous 
triggering of the respective triggering circuits is not 
possible, even in the event of a defective microcontroller. 

30 

The required hardware path or modules must perform the 
following functions : 

- Analyzing the signal lines of the deactivation switch 

- Filtering the signals 
35 - Processing the signals 

- Detecting and handling errors, i.e., a defect in the switch, 
interruption of the battery supply 

- Determining default states after switch-on 

- Defining the time response: timeouts, hold times, and delays 
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3 



- Activating or deactivating the defined triggering circuits 
via hardware intervention 

- Responding to switch-off of the airbag control unit. 
Attention should be paid to the fact that, after the battery 

5 supply is switched off, the control unit still draws power 
for some time from its own power reserve. 

Possible implementations of this module in the airbag control 
unit are discrete circuits having operational amplifiers 
10 and/or comparators for processing the respective input signals 
of the airbag deactivation switches, and for triggering 
suitable activation circuits and deactivation circuits. 

Activation and deactivation of the restraining means may take 
15 place in different ways: 

- Switching on and off the supply voltage of the respective 
triggering circuit IC's 

- Switching on and off the trigger voltage supply for the 
20 respective triggering circuits 

- Interrupting the triggering circuits, shorting the 
triggering circuits to ground, or shorting the ignitor 

- Intervening in the logic control of the triggering circuits, 
in or at the triggering circuit IC. 

25 

Signal filtering and time response of the circuit during 
normal operation, as well as in the event of an error, are 
implemented by suitable circuit elements. RC elements are 
possible here, but they have disadvantages. Such disadvantages 

30 are: time invariance, i.e., only a certain time response is 
possible; it is not possible to differentiate between 
different operating states; there are relatively great 
tolerances; dimensioning, availability, and the size of 
resistors and capacitors are limited, and in particular, delay 

35 times and hold times longer than a few hundred milliseconds 
are difficult to implement. 

According to the present invention, the redundant hardware 
path is implemented by using logic modules. Such logic modules 
40 include gates and flip-flops, i.e., multivibrator circuits. 
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These make it possible to achieve time-variant approaches with 
delay times and hold times of any length. The microcontroller 
or processor may assume the time control of the logic modules. 
In this case, however, the processor has only the possibility 
5 to control the time response of the module for analyzing the 
state of the airbag deactivation switches, but not the state 
of the restraining means activation or restraining means 
deactivation. This is important to preserve the concept of 
redundancy . 

10 

Figure 1 shows the protective device according to the present 
invention in a first block diagram. The protective device 
according to the present invention has an airbag deactivation 
switch 1 and an airbag control unit 4 which are connected to 

15 one another. Airbag deactivation switch 1 has two Hall sensors 
2 and 3 which are interconnected on an electrode where they 
receive power from control unit 4 and a current limiter 6. 
Current limiter 6 itself is supplied by battery voltage 5. On 
the other side, Hall sensor 2 is connected to two components 

20 of control unit 4. One is a module 7 which includes the 

voltage supply, communication interfaces, .analog inputs, and . 
an analog-to-digital converter; the other is a module 8 which 
processes and analyzes the signal of Hall sensor 2. Processing 
of the sensor signals forks into two paths here. The digitized 

25 Hall signal is transmitted to microcontroller 9 via module 7, 
the microcontroller processing the signal to determine whether 
the deactivation switch has been operated or not. At the same 
time, module 8 performs the same procedure, module 8 also 
having access to an analog-to-digital converter in order to 

30 execute a digital analysis. The other electrode of Hall sensor 
2 is also connected to module 7 and module 8 to make redundant 
processing of the Hall sensor signals possible here also. 

Processor 9 activates or deactivates the deployment of the 
3 5 restraining means via software according to the switch 

position of deactivation switch 1. One or both Hall sensor 
signals are filtered and analyzed in module 8. This is 
followed by triggering of safety semiconductor 13 via hardware 
for activating or deactivating the appropriate triggering 
40 circuits. However, block 10 and block 11 are also switched 
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between these two procedures. Block 10 enables the activation 
of the airbag triggering circuits as a function of the status 
of the deactivation switch and combines this with an 
additional enable signal from processor 9. This makes it 
5 possible not to enable airbag output stages 12 by processor 9 
before, in the event of a crash, deployment should indeed take 
place, regardless of whether the deactivation switch is in the 
"on" or "off" position. However, due to block 10, 
microcontroller 9 has the possibility to activate output 

10 stages 12 via safety semiconductor 13 only when deactivation 
switch 1 is also in the "on" position. If deactivation switch 
1 is in the "off" position, then output stages 12 are 
deactivated independently of the processor enabling line to 
block 10. Particularly in airbag control units having a DC 

15 ignition, this function represents an additional protection 

against erroneous deployment in the event of defects in output 
stage IC 12. It is alternatively possible to omit block 10. 
The output signal of block 10 is supplied to a block 11 which 
represents a logic circuit unit and which may be implemented 

20 using flip-flops.. This block enables storage and freezing- in 
of the deactivation switch state. The storage is volatile, 
i.e., it is not preserved when the airbag control unit is 
switched off. Processor 9 has the possibility to control 
whether the logic state of safety semiconductor 13 and thus 

25 the activation or deactivation of the respective airbag 

triggering circuits 15 through 18 is frozen, thereby becoming 
independent of possible changes in the switch position of 
deactivation switch 1, or whether each change in the switch 
position instantaneously results in activation or deactivation 

30 of airbag triggering circuits 15 through 18. Here again, it is 
important that processor 9 is only able to freeze- in the state 
of safety semiconductor 13, but has no bearing on the state 
itself. Varied and very flexible options for controlling the 
analysis of deactivation switch 1 arise from this concept of 

35 logic storage or freezing-in of the state of the hardware 
path, such as: 

- any hold times or delay times are possible, 

- in the event of an error, a crash, or a power reserve 
4 0 problem, the state of the hardware path may be frozen, 
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- it is possible to control whether the state of deactivation 
switch 1 is read in and received only once at the start of a 
closing cycle, or whether a change in the switch position is 
permissible at any time. 

5 

As mentioned before, block 11 is connected to safety 
semiconductor 13, which is in turn connected to power reserve 
14 and output stages 12 . Power reserve 14 is normally at least 
one capacitor which, in the event of an interruption of the 

10 battery connection, supplies power for a certain amount of 
time for continued operation. Processor 9 is directly 
connected to output stages 12 via a data output to control the 
output stages via software. Output stages 12 are connected to 
triggering circuits 15 through 18, respectively. As described 

15 above, processor 9 itself is connected to block 10 via an 

enable line to establish an AND gate, as well as to block 11 
to influence the time response. 

Safety semiconductor 13 is normally a transistor switch. 

20 

The protective device according to the present invention has 
the advantage that it is independent of the design of 
deactivation switch 1, i.e., it does not matter whether it is 
a resistor network or one or two Hall sensors. Furthermore, 

2 5 the protective device is independent of the type of supply of 

deactivation switch 1. It is also independent of whether the 
hardware path analyzes only one Hall sensor and/or one 
resistor network, or two or multiple Hall sensors and/or 
resistor networks. It is furthermore independent of the type 

3 0 of restraining means to be deactivated. The present invention 

is also independent of the type of deactivation of the 
restraining means, i.e., whether it is a question of switching 
on and off the supply voltage of the respective triggering 
circuit IC's, or switching on and off the trigger voltage 

35 supply, or interrupting the triggering circuits, or shorting 
the triggering circuits, or intervening in the logic control . 
of the triggering circuits. The present invention is also 
independent of whether the position of deactivation switch 1 
is input in the software part via a separate IC or directly by 

40 the microcontroller, i.e., there is an A/D converter in the 
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microcontroller itself. The order of blocks 10 and 11 may also 
be exchanged . 

Figure 2 shows a second block diagram of the protective device 
5 according to the present invention. Except for the power 

supply of deactivation switch 19, deactivation switch 19 and 
control unit 21 have the same elements. A current limiting 
unit 20 or fuse is situated directly at deactivation switch 
19, thereby externally supplying the deactivation switch. The 
10 other elements are situated and indicated exactly as in Figure 
1 . 
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